ntop blog
Network monitoring news, releases and tutorials
From the ntop team: ntopng, nProbe, nDPI, PF_RING, packet capture and network security.
Latest articles by topic
Sharkfest 26EU: HowTo Detect Stealth VPN and AI Inference Traffic
Earlier this week we have presented at Sharkfest Europe 2026 a presentation of our work about traffic detection of Stealth VPNs and AI Inference. The presentation addresses the challenges of detecting modern …
Detecting CVE-2026-98432 using nDPI/ntopng
CVE-2026-98432 is a critical, 9.8-severity use-after-free (UAF) vulnerability in the Linux kernel’s IPv4 TCP networking stack. It allows an unauthenticated remote attacker to potentially cause system crashes, memory corruption, or execute arbitrary commands with root …
How we Redesigned Search in ntopng
ntopng has had a search box for a while, but it we made it better to allow search for menu entries too! This to speed up and improve the user experience and…
October 20th: Join us for the ntopng 7.0 Webinar
Is your network monitoring keeping pace with AI, larger infrastructures, and the growing need for real observability? We're excited to introduce ntopng 7.0, alongside new releases of the rest of the ntop…
AI Dashboards in ntopng: Build Charts by Asking
If you've opened ntopng recently you may have noticed a new entry under the dashboards menu: AI Dashboards. Instead of picking a metric, a chart type and a time range from a…
Introducing the nDPI TCP Fingerprint: A Stable, Patent-Free Way to Fingerprint TCP Stacks
Every TCP connection starts with a SYN, and that first packet says a lot about the machine that sent it. The Linux, Windows, macOS and Android stacks each set different flags, choose…
AS/IXP Traffic Observability: From Flows to AI-Assisted Root-Cause Analysis
For most network operators, traffic visibility is not mandated by regulation, so it tends to be reactive rather than continuous: a "manual" investigation happens only after something breaks. Combined with limited time…
Introducing nDPI TLS Fingerprint: A Stable, Collision-Resistant Successor to JA4
TLS client fingerprinting has become one of the workhorse techniques in network security, and JA4 (FoxIO) has been the de facto standard for identifying TLS clients from their ClientHello messages. But recent…
ntopng User Interface: Introducing the New Navigation Bar
In our continuous effort to improve user experience and make network monitoring more intuitive, we have completely redesigned the ntopng Navigation Bar. As our feature set expands—with crucial additions like the nAnalyst…
Elevate Your Network Visibility with ntop Professional Training November 2026
As network architectures evolve, staying ahead of performance issues and modern cybersecurity threats requires deep visibility and mastery of your tools. Here at ntop, our product range spans from high-speed packet capture…
Detecting CVE-2026-98432 using nDPI/ntopng
CVE-2026-98432 is a critical, 9.8-severity use-after-free (UAF) vulnerability in the Linux kernel’s IPv4 TCP networking stack. It allows an unauthenticated remote attacker to potentially cause system crashes, memory corruption, or execute arbitrary commands with root …
October 20th: Join us for the ntopng 7.0 Webinar
Is your network monitoring keeping pace with AI, larger infrastructures, and the growing need for real observability? We're excited to introduce ntopng 7.0, alongside new releases of the rest of the ntop…
ntopng User Interface: Introducing the New Navigation Bar
In our continuous effort to improve user experience and make network monitoring more intuitive, we have completely redesigned the ntopng Navigation Bar. As our feature set expands—with crucial additions like the nAnalyst…
Welcome to ntopng 7.0: Modern GUI, nAnalyst, Sites, Observability, BGP/BMP, PQC, Wazuh…
We are excited to announce the release of ntopng 7.0, the most significant update to ntopng in years. This release touches nearly every part of the product: A brand-new AI-assisted (yes you…
HowTo Collect Flows: the Case of Palo Alto and Fortinet
Network devices export flow data in many flavors. Some vendors stick closely to the NetFlow/IPFIX standard, so collecting their flows is essentially plug-and-play. Others extend the standard with proprietary Information Elements (IEs)…
Supercharging ntopng: Engineering a Fast, Modern Network GUI
If you've opened ntopng recently, you may have noticed something feels a little different — a little faster. That's not your imagination. We've rebuilt the main menu, footer and top header, interfaces…
Who Is Eating My Bandwidth ?
Every network administrator has, at some point, asked the same question: who is eating my bandwidth? On a typical corporate LAN connected via flat-rate fiber, the answer is mostly a curiosity —…
Previewing nAnalyst, the layer that finally explains your network
Today we have previewed out first AI-based tool named nAnalyst during out webinar taht we have run with support of the Alibaba Qwen team. This tool is designed to (finally) explain what…
Observability: Enabling High-Resolution Timeseries in ntopng
Modern observability platforms are expected to answer questions that traditional monitoring systems were never designed to handle: What exactly happened during that 20-second congestion spike? Which application caused the transient burst? Why…
AI-Powered Network Monitoring: Introducing ntopng MCP Server
AI-Powered Network Monitoring: Introducing ntopng MCP Server for Headless SecurityConnect your network monitoring directly to AI assistants. Query ClickHouse flows, pull live host stats, and automate security investigations—all through natural language.Table of…
nProbe 11.2: BGP/BMP Support, OT Protocols, Faster Flow Collection
We are pleased to announce the release of nProbe 11.2, bringing major new capabilities for network visibility, routing intelligence, flow analysis, and OT monitoring. This release significantly expands nProbe beyond traditional flow…
HowTo Collect Flows: the Case of Palo Alto and Fortinet
Network devices export flow data in many flavors. Some vendors stick closely to the NetFlow/IPFIX standard, so collecting their flows is essentially plug-and-play. Others extend the standard with proprietary Information Elements (IEs)…
Observability: Enabling High-Resolution Timeseries in ntopng
Modern observability platforms are expected to answer questions that traditional monitoring systems were never designed to handle: What exactly happened during that 20-second congestion spike? Which application caused the transient burst? Why…
Post-Quantum Cryptography (PQC) Analysis
Modern digital security relies on public-key encryption (like RSA and ECC) to protect global data. The future arrival of a Cryptographically Relevant Quantum Computer (CRQC) will completely break these mathematical foundations. To…
Network Telemetry Demystified: Microscope vs Telescope
As an ntopng developer, I often hear from users who are confused about the building blocks of network monitoring. Today, I'll explain three fundamental concepts that will help you understand what your…
Capacity Planning for IT Teams: A Practical Guide Using ntop Tools
Transform network data into actionable infrastructure decisions with ntopng Introduction Every IT team faces the same challenge: how much network capacity is enough? Too little, and applications grind to a halt during…
Slow DoS Detection and Prevention
A slow DoS (Denial of Service) attack is a type of cyberattack designed to overwhelm a server or web application by exploiting protocol weaknesses—not through high-volume traffic, but by sending requests very…
nProbe 11.0: Smarter Flow Analysis, Deeper Protocol Visibility, Enhanced GTP Traffic Correlation
We’re excited to announce the release of nProbe 11.0. This release incorporates several improvements and brings major improvements in flow analysis, tunnel handling, and TCP statistics, along with new features that make…
HowTo Dump Collected Flows and nTap Packets with nProbe
When nProbe collects data (both sFlow/NetFlow/IPFIX and nTap), it immediately discards collected data after processing. However sometimes it is useful to dump such data. A typical use-case include: nProbe collects packets sent…
HowTo Measure the Status and Performance of Network Flows
NetFlow has been originally designed to monitor network traffic using simple bytes/packets metrics. For TCP, it is also possible to know what TCP flags (that indicate the connection state) have been used…
Sharkfest 26EU: HowTo Detect Stealth VPN and AI Inference Traffic
Earlier this week we have presented at Sharkfest Europe 2026 a presentation of our work about traffic detection of Stealth VPNs and AI Inference. The presentation addresses the challenges of detecting modern …
Detecting CVE-2026-98432 using nDPI/ntopng
CVE-2026-98432 is a critical, 9.8-severity use-after-free (UAF) vulnerability in the Linux kernel’s IPv4 TCP networking stack. It allows an unauthenticated remote attacker to potentially cause system crashes, memory corruption, or execute arbitrary commands with root …
Introducing the nDPI TCP Fingerprint: A Stable, Patent-Free Way to Fingerprint TCP Stacks
Every TCP connection starts with a SYN, and that first packet says a lot about the machine that sent it. The Linux, Windows, macOS and Android stacks each set different flags, choose…
Introducing nDPI TLS Fingerprint: A Stable, Collision-Resistant Successor to JA4
TLS client fingerprinting has become one of the workhorse techniques in network security, and JA4 (FoxIO) has been the de facto standard for identifying TLS clients from their ClientHello messages. But recent…
Introducing nDPI 6.0: Licensing Update, Slow DoS Detection and Smarter Fingerprints
We are proud to announce the release of nDPI 6.0, the latest major update to our open-source Deep Packet Inspection (DPI) toolkit. This release brings an important licensing update, a brand-new detection…
Announcing nDPI Dual License Change
A License Change for nDPI: Protecting the Project We Started in 2012 When we began nDPI back in 2012, the idea was simple: build an open source, high-performance Deep Packet Inspection engine…
Post-Quantum Cryptography (PQC) Analysis
Modern digital security relies on public-key encryption (like RSA and ECC) to protect global data. The future arrival of a Cryptographically Relevant Quantum Computer (CRQC) will completely break these mathematical foundations. To…
Observing nDPI from the Inside: Introducing USDT Tracepoints
by Ivan Nardi One of the recurring challenges when embedding the nDPI library into a production application is answering a deceptively simple question: what is nDPI actually doing right now? You know…
Slow DoS Detection and Prevention
A slow DoS (Denial of Service) attack is a type of cyberattack designed to overwhelm a server or web application by exploiting protocol weaknesses—not through high-volume traffic, but by sending requests very…
Is JA4 Now Obsolete?
JA4 is a modern network fingerprinting standard used to identify and profile clients initiating encrypted TLS (Transport Layer Security) connections. JA4 it is the successor to the widely used but now deprecated…
nProbe Cento at Scale: Flow Offload Acceleration on Napatech
High-speed networks continue to push the limits of software-based monitoring and security applications. As link speeds grow and traffic patterns become more complex, efficiently analyzing packets while maintaining per-flow state, for updating…
Released PF_RING 9.0.0: Fully Fledged Hardware Flow Tracking
This is to announce a new PF_RING release 9.0.0! This release brings significant improvements for a deeper flow tracking integrations, making PF_RING even more powerful for building high-performance flow processing networking applications…
Released PF_RING 8.8.0: Flow Table Offload and nVidia BlueField Support
This is to announce a new PF_RING release 8.8.0! This release adds generic support for flow table offload, which is currently supported on Napatech adapters with Flow Manager enabled. This new technology…
Fixing Packet Deduplication: Introducing nDedup
When it comes to monitor a busy network, network monitoring tools can become bogged down, or even worse produce misleading information for your analysis, by a hidden culprit: duplicate packets. Imagine a…
Scaling Up ntopng Flow and Packet Processing
As traffic rate increases, it is important to tune packet processing in order to avoid drops and thus educe visibility. This post will show you a few tricks for improving the overall…
Enabling Zeek and Suricata On-Demand at 40/100 Gbit using PF_RING
Overview Those of you who have some experience with IDS or IPS systems, like Zeek and Suricata, are probably aware of how CPU intensive and memory consuming those applications are due to…
Introducing PF_RING 8.4: Zero-Copy Promisc Capture on Virtual Functions
This is to announce a new PF_RING release 8.4 ! This stable release adds zero-copy support for a new range of (virtual) adapters from Intel: the iavf-zc driver can be used to…
HowTo Select the Right Network Adapter for Traffic Monitoring and Cybersecurity
Since the introduction of PF_RING ZC drivers for Mellanox/NVIDIA, and the new family of Intel E810 adapters, the activity of selecting the best, cost-effective adapter, based on the use case and the…
Introducing PF_RING 8.2: New Mellanox Support
This is to announce a new PF_RING release 8.2! This new stable version adds support for a new family of ASIC-based adapters from Mellanox/NVIDIA, including ConnectX-5 and ConnectX-6 (please check the User's…
How PF_RING is Used to Fight Internet Censorship: Refraction Networking
Internet censorship is a global phenomenon (see Figure 1) that aims to throttle or entirely block access to certain Internet resources. National or regional governments impose Internet censorship by using sophisticated networking…
October 20th: Join us for the ntopng 7.0 Webinar
Is your network monitoring keeping pace with AI, larger infrastructures, and the growing need for real observability? We're excited to introduce ntopng 7.0, alongside new releases of the rest of the ntop…
Introducing nDPI TLS Fingerprint: A Stable, Collision-Resistant Successor to JA4
TLS client fingerprinting has become one of the workhorse techniques in network security, and JA4 (FoxIO) has been the de facto standard for identifying TLS clients from their ClientHello messages. But recent…
Cento 2.6: ClickHouse Support, Enhanced Tunnel Visibility, PQC, and more
We are pleased to announce the release of cento 2.6, bringing a broad set of new capabilities and improvements to high-performance traffic processing and flow export. This release expands cento’s integration with…
nProbe 11.2: BGP/BMP Support, OT Protocols, Faster Flow Collection
We are pleased to announce the release of nProbe 11.2, bringing major new capabilities for network visibility, routing intelligence, flow analysis, and OT monitoring. This release significantly expands nProbe beyond traditional flow…
Previewing nAnalyst, the layer that finally explains your network
Today we have previewed out first AI-based tool named nAnalyst during out webinar taht we have run with support of the Alibaba Qwen team. This tool is designed to (finally) explain what…
AI-Powered Network Monitoring: Introducing ntopng MCP Server
AI-Powered Network Monitoring: Introducing ntopng MCP Server for Headless SecurityConnect your network monitoring directly to AI assistants. Query ClickHouse flows, pull live host stats, and automate security investigations—all through natural language.Table of…
Introducing nProbe 10.8: QoE, AWS/GCP VPC Support, Better GTP Traffic Correlation
We’re excited to announce the new nProbe 10.8 release! This release introduces features that improve visibility, performance, and protocol intelligence, while also addressing many community-requested improvements and fixes. Quality of Experience (QoE)…
Released Cento 2.2: Enhanced Flow Offload, QoE Metrics, and GTP Correlation
We're excited to announce a new release of Cento 2.2, our high-performance flow-based traffic processing engine. This release brings major enhancements in traffic analysis capabilities, particularly for mobile network monitoring, quality assessment,…
Released PF_RING 9.0.0: Fully Fledged Hardware Flow Tracking
This is to announce a new PF_RING release 9.0.0! This release brings significant improvements for a deeper flow tracking integrations, making PF_RING even more powerful for building high-performance flow processing networking applications…
Introducing the New Infrastructure Dashboard in ntopng
For this reason, some time ago we introduced the Infrastructure Monitoring in ntopng, as described in a previous blog post, which is the ability to use ntopng to monitor other ntopng instances,…
ntop and the EU Cyber Resilience Act
Under the EU Cyber Resilience Act (CRA), it has become compulsory for manufacturers of products sold on the EU market to report exploited vulnerabilities and severe incidents. As a result, ntop is…
Introducing ntop SBOM (Software BOM)
A Software Bill of Materials (SBOM) is a formal, machine-readable inventory that lists every component, library, and dependency included within a software application. Think of it as a digital "ingredient label" that…
Merging ntopng Asset Inventory with Wazuh
Wazuh is a free, open-source security platform that combines SIEM (Security Information and Event Management) and XDR (Extended Detection and Response) capabilities. It is primarily used to monitor endpoints, cloud workloads, and…
Security Investigation for Beginners (using ntopng)
Introduction When I first started investigating network security incidents, I felt overwhelmed by the complexity. Packets flying everywhere, mysterious connections, alerts I didn't understand—sound familiar? Whether you're an IT professional new to…
Slow DoS Detection and Prevention
A slow DoS (Denial of Service) attack is a type of cyberattack designed to overwhelm a server or web application by exploiting protocol weaknesses—not through high-volume traffic, but by sending requests very…
When SNIs Cannot be Trusted
SNI (Server Name Indication) is an optional extension in TLS/QUIC that contains the symbolic host name we're connecting to. For instance, during the TLS handshake, the SNI allows the server to identify…
Using Network Fingerprints Beyond Cybersecurity
Last week ntop has been invited to give a talk at neacademy in Napoli, Italy. The topic was network fingerprints and nDPI. Network fingerprints such as JA4 have been made popular by…
A Deep Dive Into Traffic Fingerprints
Last week during SharkFest Europe 2024 we have presented what are network fingerprints and how they work. During the talk we (Luca and Ivan) have described how we have extended nDPI with…
Can ntopng be considered an IDS (Intrusion Detection System) ?
ntopng is not typically classified as an Intrusion Detection System (IDS) in the traditional sense, but it does have some features that overlap with IDS functionalities. Let me explain the differences and…
ipt_geofence: Protecting Networks using Geofencing, Blocklists and Service Analysis
Last week the ntop team has organised the network devroom at FOSDEM 2024, that took place in Brussels on Feb 2-3. During the devroom we have presented one tool named ipt_geofence that…
